CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 02/08/2017 |
| CVE-2016-8743 | ÉLEVÉE7.5 | Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, | 27/07/2017 |
| CVE-2017-7980 | ÉLEVÉE7.8 | Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation. | 25/07/2017 |
| CVE-2015-3198 | ÉLEVÉE7.5 | The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL. | 21/07/2017 |
| CVE-2016-4996 | ÉLEVÉE7.0 | discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal when used to log in, which allows local users with access to the system journal to obtain the root password by reading the system journal, or by clicking Logs on | 17/07/2017 |
| CVE-2016-0764 | MOYENNE6.2 | Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows local users to obtain sensitive connection information by reading temporary files during ifcfg and | 17/07/2017 |
| CVE-2017-9788 | CRITIQUE9.1 | In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialize | 13/07/2017 |
| CVE-2016-7062 | ÉLEVÉE7.8 | rhscon-ceph in Red Hat Storage Console 2 x86_64 and Red Hat Storage Console Node 2 x86_64 allows local users to obtain the password as cleartext. | 27/06/2017 |
| CVE-2015-1795 | ÉLEVÉE7.8 | Red Hat Gluster Storage RPM Package 3.2 allows local users to gain privileges and execute arbitrary code as root. | 27/06/2017 |
| CVE-2015-3142 | MOYENNE4.7 | The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them, which allows local users to obtain sensitive information by leveraging write permissions to the working directory of a crashed application. | 26/06/2017 |
| CVE-2015-1870 | MOYENNE5.5 | The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensitive information from /var/log/messages via unspecified vectors. | 26/06/2017 |
| CVE-2017-3167 | CRITIQUE9.8 | In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. | 20/06/2017 |
| CVE-2017-1000376 | ÉLEVÉE7.0 | libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 o | 19/06/2017 |
| CVE-2016-5411 | CRITIQUE9.8 | /var/lib/ovirt-engine/setup/engine-DC-config.py in Red Hat QuickStart Cloud Installer (QCI) before 1.0 GA is created world readable and contains the root password of the deployed system. | 13/06/2017 |
| CVE-2016-4471 | ÉLEVÉE8.8 | ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code. | 08/06/2017 |
| CVE-2016-4457 | ÉLEVÉE7.5 | CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate. | 08/06/2017 |
| CVE-2016-3690 | CRITIQUE9.8 | The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload. | 08/06/2017 |
| CVE-2014-3498 | ÉLEVÉE8.8 | The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands. | 08/06/2017 |